Group to Group Commitments
Do Not Shrink
Masayuki ABE
Kristiyan Haralambiev
Miyako Ohkubo
1
Copyright (c) 2012 NTT Secure Platform Labs.
Contents
• Introduction for Structure-Preserving Schemes
– Motivation
– State of the Art
• Structure-Preserving Commitments (SPC)
– Lower Bounds
• size(commitment) >= size(message)
• #(verification equations) >= 2 in Type-I groups
– Upper Bounds
• constructions with optimal expansion factor
2/32
Copyright (c) 2012 NTT Secure Platform Labs.
Modular Protocol Design
• Combination of Building Blocks
– Encryption, Signatures, Commitments, etc..
• Zero-knowledge Proof System
ex) Proving possession of a valid signature without showing it.
• Extra Requirements
– Non-interactive, Proof of knowledge
Copyright (c) 2012 NTT Secure Platform Labs.
NIZK in Theory
Translate “Verify” function
into a circuit. Then prove
the correctness of I/O at
every gate by NIZK.
Very powerful tool.
But not practical.
Copyright (c) 2012 NTT Secure Platform Labs.
Practical NIZK
• Groth-Sahai Proof System [GS08]
– Currently the only practical Non-Interactive Proof system.
– Works on bilinear groups.
– A Witness Indistinguishable Proof System (NIWI) for
quadratic relations among witnesses.
– A Proof of Knowledge for relations represented by pairing
product equations. (see next page)
Copyright (c) 2012 NTT Secure Platform Labs.
Pairing Product Equation
Z=1 for ZK
witnesses must be base group elements for PoK
Bilinear Groups
Copyright (c) 2012 NTT Secure Platform Labs.
Structure-Preserving Schemes
• Cryptographic schemes such as signatures,
encryption, commitments, etc...
– constructed over bilinear groups, and
– public objects such as public-keys, messages, signatures,
commitments, de-commitments, ciphertexts, and etc., are
group elements, and
– relevant verifications such as signature verification, correct
decryption, correct decommitment, evaluate pairing
product equations.
7/32
Copyright (c) 2012 NTT Secure Platform Labs.
Structure-Preserving Schemes
• Proof System
– NIWI: [GS08]
– GS with Extra Properties: [BCCKLS09,Fuc11,CKLM12]
• Signature Schemes
– Constructions: [Gro06, GH08, CLY09, AFGHO10, AHO10, AGHO11,
CK11]
– Bounds: [AGHO11, AGH11]
• CCA2 Public-Key Encryption
– [CKH11]
• Commitment Schemes
– Constructions: [Gro09, CLY09, AFGHO10, AHO10]
8/32
Copyright (c) 2012 NTT Secure Platform Labs.
STRUCTURE-PRESERVING
COMMITMENTS (SPC)
9/32
Copyright (c) 2012 NTT Secure Platform Labs.
Syntax
vector of group elements
from the base group (Strict-SPC)
evaluates pairing product equations
10/32
Copyright (c) 2012 NTT Secure Platform Labs.
SPC in the Literature
Question:
Can Strict-SPC be shrinking?
11/32
Copyright (c) 2012 NTT Secure Platform Labs.
Impossibility Result (1)
The theorem holds for
type-III groups as well.
12/32
Copyright (c) 2012 NTT Secure Platform Labs.
Algebraic Algorithm
13/32
Copyright (c) 2012 NTT Secure Platform Labs.
Alg.Alg. is not KEA
• Algebraic Algorithms
–
–
–
–
Class of Reduction / Construction
Often used for showing separation
Considered as “not overly restrictive”
Positive consequence if avoided
• Knowledge of Exponent Assumption
–
–
–
–
14/32
Assumption on adversaries
Often used in security proofs for specific constructions
Often criticized as too strong since it is not falsifiable
Negative impact if not hold
Copyright (c) 2012 NTT Secure Platform Labs.
Proof Intuition (1/3)
15/32
Copyright (c) 2012 NTT Secure Platform Labs.
Proof Intuition (2/3)
16/32
Copyright (c) 2012 NTT Secure Platform Labs.
Proof Intuition (3/3)
17/32
Copyright (c) 2012 NTT Secure Platform Labs.
Impossibility Result (2)
18/32
Copyright (c) 2012 NTT Secure Platform Labs.
OPTIMAL CONSTRUCTIONS
19/32
Copyright (c) 2012 NTT Secure Platform Labs.
Two New Strict-SPCs
All schemes are
homomorphic and trapdoor
as well as previous schemes.
20/32
Copyright (c) 2012 NTT Secure Platform Labs.
Scheme 1 in Type-III Groups
21/32
Copyright (c) 2012 NTT Secure Platform Labs.
Security
DBP is implied by SXDH.
22/32
Copyright (c) 2012 NTT Secure Platform Labs.
Summary
• Upper and Lower Bounds for Strict-SPC
– Strict-SPC does not shrink!
– Bounds w.r.t. commitment size match each other
except for small additive terms.
• Open Issues
– Get rid of the additive terms, or show its
impossibility.
– Do non-algebraic constructions help to get around
the lower bound?
23/32
Copyright (c) 2012 NTT Secure Platform Labs.